Ethereal-users: Re: [Ethereal-users] Promiscuous mode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 22 Dec 2003 11:55:06 -0800

On Dec 22, 2003, at 9:12 AM, Eric S. wrote:

ethereal-setup-0.10.0
WinPcap_3_01_a
GTK-Runtime-Environment-2.2.4.1
 
Another user told me that I don't need the GTK file to use the program under windows.  Is that true?

You shouldn't need it - the ethereal-setup executable should install GTK+ (and GLib).

I have tried the program with the GTK installed, and not installed, and neither seems to work correctly.
 
I am able to collect packets, but only ones that are directed at my laptop.

GTK+ isn't involved with that issue.

  I don't seem to be able to collect the packets that I think are going by my port.  I have checked "Capture Packets in Promiscuous Mode", but I only get my own, and broadcasts.

	http://www.ethereal.com/faq.html#q5.1

  I tested this by going to a computer and pinging my computer, which showed the requests and replies, but when I ping another computer, I don't see the icmp protocol.

I.e., if you're running Ethereal on one computer, and, on another computer, ping some third computer, you don't see the traffic?

See the FAQ above.

My ultimate goal of using ethereal is to use it to capture ip telephony packets.  I have a small demo ip phone system, which I am trying to troubleshoot.  It is a very simple setup with only a hub, and ip telephone, my laptop, and the phone system lan card.  I only capture traffic off of the hub that is directed to my computer.  I am not able to see any packets for the ip phone.

As per the FAQ, your "hub" is probably either a switching hub (which is a device where the "switch" part is more important than the "hub" part - i.e., a "switching hub" is a switch) or a dual-speed hub (in which case the network interface on the machine doing the packet capture has to be running at the same speed as the other machines, or it won't see the traffic between those machines).